Most AI governance lives in documents — a policy here, a spreadsheet there, a decision someone remembers making. It reads well until a client, a regulator or an auditor asks what you actually do and when you decided it. BcomOne is the platform we implement so that the answer is a record, not a reconstruction.
Each of these is a working part of the system, not a document template. They are connected: a decision references the system it was made about, a risk references the criteria it was judged against, and every one of them lands on the same evidence timeline.
What is actually in use across the organisation — including the automated systems nobody calls AI, which the December ADM obligation makes newly important. Systems can be discovered and proposed automatically; none becomes governed without a person approving it.
Every system enters pending a decision. Approving it records who decided, in what capacity, on what date and on what reasoning — and a rejected system stays visible as detected rather than disappearing.
Your risk criteria are stated first, in four parts, and assessments are judged against them. The platform refuses to record an assessment before the criteria exist, because assessment against no stated line is opinion.
What you owe, to whom, by when, and its current status — alongside the stakeholders whose expectations feed your governance decisions, and the goals you are measuring yourself against.
Every act is appended to a hash chain that cannot be edited or deleted, and is verified on a schedule. If a record were altered at the database level, verification fails and names the first point of divergence.
Checkpoints identify the Standard, edition and clause with the official source link, and record your practitioner's own determination. The management review pack assembles the nine inputs a review needs and refuses to close while any is missing.
This is the part that matters most, and it is the opposite of a licence-and-good-luck arrangement.
We set it up, run the investigation under our oversight, keep the obligations current and produce the reporting. A system enters your register only as pending until your authorised representative approves it. You are buying an independent AI governance assessment. Bcom Services conducts the assessment using BcomOne; your organisation retains its governance decisions.
The decisions that belong to your organisation are made by your organisation. Your authorised representative has their own sign-in, and their documented governance decisions, including approvals and risk acceptances, are recorded under their name and identity — not ours. An auditor can see exactly who decided what, and when.
Each organisation's records, evidence chain and framework version are isolated at the data layer. A record belonging to another organisation does not merely fail to display — it does not exist as far as your workspace is concerned.
There is no self-service trial. We onboard organisations directly, because a misconfigured governance system produces confident, wrong answers — and that is worse than no system at all.
Several things this platform refuses to do are the reason its output is worth anything. Software that tells you that you are compliant is software that cannot be relied on when it matters.
| It will not | Because |
|---|---|
| Tell you that you are compliant or conformant | That determination is the practitioner's and the certification body's. The platform collects and maps evidence against obligations, and records determinations in the practitioner's own words. |
| Decide anything about your AI systems for you | It can surface a comparison — observed behaviour against the approved envelope, for instance — but a person raises the finding and a person makes the call. Suggest-only, by design. |
| Fill in your scope, criteria or context | These are your governance decisions. The platform refuses incomplete input with a reason rather than defaulting something plausible, because a defaulted scope is the kind of error nobody notices until an audit. |
| Reproduce the text of ISO/IEC 42001 | The standard is copyright ISO/IEC. Checkpoints reference it by clause with the official source link; your authorised practitioner reads the standard itself. |
| Let a record be quietly edited later | The evidence timeline is append-only and verified on a schedule. A correction is a new, attributed record — never an overwrite of the old one. |
The assessment is the priced entry point: a fixed price, days not months, and its output is what lets everything after it be quoted accurately. Implementation and ongoing operation are scoped to your situation, because a ten-person practice and a two-hundred-person enterprise are not the same job.
Delivered within up to 5 business days.
Includes onboarding, technical discovery, structured organisational investigation, system and register assessment, governance and regulatory gap analysis, and the final AI Investigator Assessment Report with a management walkthrough.
Card payment is $6,050 including GST, secured by Stripe, and you receive a tax invoice from us. Or book and we invoice you $5,500 + GST on engagement. Scope is confirmed with you before we start either way.
Most organisations start with the assessment. Its findings produce an accurate quote for building the management system around what you actually run — and for operating it on the platform year on year, so the register, decisions and evidence stay current rather than ageing in a report.
Tell us your size, sector and what AI you already use. We reply with a straight answer about scope and price, not a brochure.
No. Bcom operates BcomOne for you — setting it up, running the investigation under our oversight and keeping it current. Your authorised representative signs in to make the decisions that are theirs to make, so those decisions are recorded under their name rather than ours. There is no self-service sign-up; organisations are onboarded directly.
No, and it is built so it cannot. The platform collects and maps evidence against obligations; conformity determinations are recorded in the practitioner's own words. Certification is issued by an accredited certification body, never by us or by the software.
No. It can discover systems and surface comparisons — for example where observed behaviour sits outside what was approved — but a person records every decision. Approving a system, accepting a risk, raising a drift finding and attesting a conformity checkpoint are all human acts, and the platform refuses to complete them on your behalf.
A current register of the AI and automated systems in use, the decisions made about each one with who made them and when, your risk criteria and assessments, your obligations and their status, and an evidence timeline that can be verified for tampering. That is what answers a client due-diligence questionnaire, a procurement request or an auditor.
Before any platform or any standard, the useful first question is which AI and automated systems are in use across your organisation and which of them make or shape decisions about people. That is an assessment, it takes days rather than months, and it is the input everything else runs on.